[+] Using Google dorks for unique subdomains?
Try this:
site:*-*-*.yourtarget.com
site:*-*.*.yourtarget.com
site:*.*.*.yourtarget.com
#bugbountytips#bugbountytip#AEMSecurity
[+] POC Video Microsoft Sharepoint Filter Bypass!
Looking back in time, I found an interesting filter bypass that resulted in a "Stored XSS" vulnerability affecting Microsoft Sharepoint 2013 in Office 365 (cloud)
https://t.co/HmnJuRvdVM
#AEMSecurity#bugbountytips#bugbounty
Helios, automated XSS auditing. I'm releasing this in very early stages but I'm pretty happy with a couple days' work, excited to see where it could go.
Feedback and testing is greatly appreciated!
Key Features Listed in the Github :)
#XSS#BugBounty
https://t.co/8fFjh7BW5g
[+] Dont ignore those out of scope domains!
Recently, I saw an application. This domain was listed as out of scope unfortunately..
More recon on target assets, I noticed very same application hosted on an IP owned by the same org
Result: 4 IDOR's, 4 SXSS's
#bugbountytips
If you are looking for XSS and come across an input form lets say "description" ? instead of injecting your payload on the very first line, skip the first two i.e. press enter or something and then inject your payload on the next line instead.. #bugbountytips#XSS#AEMSecurity
[+] Auth Bypass:
Find valid endpoints redirecting to login page.
Register new user, provide 1 in all input fields.
SUBMIT form, of course you're going to get an error, IGNORE and simply access endpoints you enumerated earlier...
#bugbountytips#pentesting#AEMSecurity
@AEMSecurity Yes it is high level. Subscibed 🤯
Editing is super. I like your intro then xss blow my mind.
Interesting fact was when you add
;.html and you got worked <h1> tag
#bugbountytips#AEMSecurity
If you have confirmed an HTML injection on AEM Instance however XSS is limited because you are unable to execute document.domain or document.cookie???
Try (cookie) ;)
#bugbountytip
I earn a €300 bounty on the Yogosha platform
AEM_Tips:
I analyzed the javascript code, I found this parameter, but I can't bypass of Content-Type
here is the template: https://t.co/vf1817y3E6
Ref: https://t.co/gtiXlW88Oq
Special thanks to @AEMSecurity#BugBountyTips
[+] #bugbountytips
You really need to analyze logs manually via "Logger" when Using Burp Suite.
I confirmed 4 HTTP Request smuggling issues + 2 SSRF's and these issues were not flagged by Burp scanner so yup! see what I mean?
#AEMSecurity#bugbountytip